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ABSTRACT 

In May of 2009, the world-renowned Hubble Space 
Telescope (HST) received a suite of new instruments 
and a refurbished bus to enable science for many years 
to come. The restoration was conducted on-orbit by 
four spacewalkers on five carefully scripted Extra- 
Vehicular Activity (EVA) days. Assuring the safety of 
the spacewalkers and their crewmates required careful 
attention to tool development, detailed procedures for 
every activity and many rehearsals with engineers and 
crew to ensure that everything worked together. 
Additionally, evolution of EVA requirements since the 
last servicing mission in 2002, and the broad scope of 
the mission demanded a much higher degree of safety 
participation in hardware design and risk acceptance 
than for previous servicing missions. 

1. BACKGROUND 

The Hubble Space Telescope (HST) fourth servicing 
mission (SM4) provided a final upgrade to one of the 
most productive assets in NASA’s collection of science 
producing instruments currently looking to the stars. 
HST is unique as it was designed and built to facilitate 
on-orbit repair and designed for upgrades of critical 


spacecraft subsystems and scientific instruments by 
servicing. Due to servicing, HST has remained 
operational and productive over the last 17 years since 
Servicing Mission 1 in 1993. Prior to SM4, and 
including SMI, there have been four other visits to the 
telescope (one servicing mission was broken into two 
parts due to the extent of the repairs and replacements). 
Due to the imminent retirement of the shuttle, Servicing 
Mission Four (4) was the final opportunity to restore 
and enhance the telescope’s capabilities using the 
orb iter. Fig. 1 provides an outline of HST and 
summarizes the repairs and replacements made for 
SM4. 

STS-125 included a crew of seven for an 1 1 day mission 
with 2 contingency days, in case of problems. Of the 7 
crew members, 4 were designated spacewalkers. The 4 
spacewalkers were divided into 2 teams of 2 with 1 
team scheduled for 2 Extra- Vehicular Activity (EVA) 
days and the second team scheduled for 3 EVA days. 
Spacewalkers are limited to 3 EVAs during a mission, 
thus one contingency EVA was reserved for potential 
shuttle repairs or problems with HST deployment. 
Each EVA was planned for over 6 hours. During the 
mission, some approached the limits for acceptable 
duration. 
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Figure 1. Hubble Space Telescope Replacement Unit 



The EVA timeline (Fig. 2) identifies the plan used to 
replace and or repair HST systems. The timeline was 
carefully crafted for EVA efficiency to ensure the 
effective use of every second available for servicing. 

The first EVA focused on replacement of Wide Field 
Camera (WFC) and Scientific Instrument Command and 
Data Handling module and addition of the Soft Capture 
Mechanism (SCM) and Latch Over-Center Kits 
(LOCKs). The second EVA enhanced core HST 
systems by installing new rate sensor units (RSUs) and 


one battery module. EVA 3 tasks include the 
installation of the Cosmic Origins Spectrograph (COS) 
and complete repair of the Advanced Camera for 
Surveys (ACS). EVA 4 time was used to repair the 
Space Telescope Imaging Spectrograph (STIS). EVA 5 
marked the final SM4 EVA with the replacement of the 
Fine Guidance System, and replacement of the bay 3 
battery module. 
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Figure 2. HST SM4 EVA Timeline 


2. INTRODUCTION 

An integral part of the safety process is the validation 
of hazard controls implemented by the HST EVA Team 
with final verification conducted by the HST Safety 
Team and documented in the Verification Tracking Log 
(VTL). As with past missions the HST Project 
developed, validated and verified mission requirements 
for SM4. Each engineering discipline has a specific set 
of requirements that must be met. Safety requirements 
span disciplines, and particularly EVA activities where 
specific tool development is crucial to the crew’s ability 
access replacement units and instruments in order to 
perform the tasks within the time limits proscribed 
within the EVA Timeline. 

When the mission was re-established in 2006, the initial 
effort was to gain an understanding of new or modified 
requirements based on previous servicing missions 
which were based on past and near term International 
Space Station (ISS) EVAs. These new requirements 
were based on new tools and interfaces developed well 


after the HST was designed and the last servicing 
mission was flown. As HST remains on-orbit and so 
cannot be retro-fitted, HST was not able to hilly comply 
with the new requirements. Additionally, the hardware 
used to transport the replacement units and instruments 
was built during and for previous servicing missions. 

The complexity of the repairs on HST required tools 
with functional sharp edges capable of cutting, prying 
and clamping. Additionally, the tools had to interface 
with an orbiting spacecraft deployed in 1990, and 
equipment built between 1990-2000. Thus, it was not 
possible to fully meet all of the safety requirements 
meant for an orbiting platform currently under 
construction. 

Through the Safety and EVA process, safety 
requirements and operational controls were developed 
and implemented to address the challenging EVA 
hazards to keep the crew safe. Fig. 3 illustrates this 
process. 
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Figure 3. Process for identifying, implementing and approving Operational Controls 


3. SAFETY PROCESS 

The safety process began with a complete Preliminary 
Hazard Assessment (PH A). For SM4 this included the 
systems/sub-systems as well as tools, equipment, crew 
position, contact hazards and crew activities to 
determine the overall hazard potential. Hazards 
identified for similar EVA tasks preformed on previous 
missions were also considered. As in past missions the 
team followed Johnson Space Center’s (JSC) phased 
safety review process through the JSC Payload Safety 
Review Panel (PSRP). The phased review process 
applies to all new Hazard Reports; new carrier hardware 
and software, new batteries, instruments, mission 
environments, and EVA operations. Mission safety 
elements including controls and verifications were 
briefed to the PSRP for approval. 

New to HST’s safety team was a new process for safety 
requirement non-compliances adopted by the PSRP for 
use on the ISS. Due to the inability to remove non- 


conforming interfaces and the need for non-compliant 
tools, operational controls to protect the crew were 
necessary. Operational controls are based on the belief 
that an informed crew, knowledgeable in the location 
and presence of hazards will take the appropriate 
cautions to reduce the risk to an acceptable level. To 
address such hazards that cannot be controlled by 
physical inhibits or design, JSC’s PSRP adopted an 
Accepted Risk Hazard Report (ARHR) format based on 
a risk mitigation approach from the United States Air 
Force. Using this approach, risks are defined by 
consequence and likelihood. Mitigations through 
operational controls are defined and tracked through 
closure using mission documentation for verification. 
ARHR’s replaced the Non-Compliance Reports (NCRs) 
used to document similar hazards on previous servicing 
missions. All previous waivers and deviations were 
rescinded when the mission was reinstated in October 
2006. ’’Grandfathering” was not an option for designs 
not meeting requirements. 






ARHRs captured HST Safety’s mitigation approach to 
many of the unique challenges on SM4. Through the 
ARHR process, the safety team identified the following 
risks mitigated through operational controls: kick-loads, 
contact hazards (sharp edges, touch temperatures), 
portable foot restraint (PFR) socket loads, and hot 
connectors. Analysis and inspection identified the 
hazards, however in most cases, these hazards could 
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only be controlled by managing EVA processes to 
implement operational controls. Controls for these 
hazards were verified by documenting the controls 
through a “Caution or Warning Statement” in the EVA 
Requirements Documentation and Contract Restrictions 
Document. Figure 4 provides an overview of the 
ARHR’ son HST SM4. 
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Figure 4. Location of Accepted Risk Hazards within the SM4 Mission Payload 


3.1 Accepted Risks-Structural 

Of the seven (7) accepted risk hazard reports, five (5) 
address structural hazards. The structural hazards fall 
into three (3) major categories: 

3.1.1 Kick loads 

Not all elements of the carriers, components or HST can 
meet kick load requirements as defined in JSC Safety 
Requirements (NSTS 07700, Volume 14, App. 7). An 
inadvertent kick could result in a Sharp Edge and/or 
damage rendering the carrier or equipment unsafe for 
landing. The sensitive IMAX camera assembly which 
included a glass cover was located along a busy 
translation path on ORUC in the payload bay between 
the airlock and telescope, and the Relative Navigation 
Sensor (RNS) cameras were behind the telescope on the 
MULE near where hardware was to be collected for 
installation. In order to mitigate this risk, kick load 
maps indicating where damage is or is not likely to 


occur were developed and provided to the crew. The 
crew practiced avoiding these locations during training 
sessions and the locations were provided as a part of on- 
board documentation used during EVA. 

3.1.2 Portable Foot Restraint (PFR) Sockets 

All carriers and HST have PFRs installed into substrates 
on in-bay equipment as well as HST for crew use during 
EVA. A broken PFR socket could result in sharp edges 
or damage supporting structure introducing a collision 
hazard. HST and three (3) of four (4) carriers were 
developed using different requirements than currently 
exist for this type of hardware. In order to mitigate this 
hazard, nominal PFR settings and capabilities were 
documented in Flight Rules and the JSC EVA Checklist 
used on-orbit. Following each Neutral Buoyancy Lab 
(NBL) practice run, EVA team member captured PFR 
settings and structural engineers analyzed each setting 
against capabilities. EVA team members then notified 
the crew as to whether or not the PFR settings were 




within substrate capabilities. PFR settings were 
included as part of the EVA checklist. Additionally, 
tools were developed permitting PFR substrate 
structural analysis in real-time, should a different setting 
be needed on-orbit due to a contingency or last-minute 
change. PFR settings for a potential servicing mission 
without the Remote Manipulator System (RMS) or arm 
were also developed and practiced during NBL training. 

3.1.3 RMS Rates and Clearances 

As HST is captured and serviced with solar arrays hilly 
deployed and contains vibration- sensitive equipment, 
the rate of capture and stowage onto the FSS (Flight 
Support System) must be carefully controlled to avoid 
damage. All previous servicing missions restricted 
RMS handling rates for HST informally. Prior to SM4, 
a specific value was not specified within hazard report 
documentation. For SM4, the addition of the SCM 
designed to provide an attachment for a future 
rendezvous significantly reduced the clearances 
between the FSS and HST. Concern about the reduced 
clearance resulted in extensive studies and the addition 
of scuff plates to the FSS to provide positive motion 
control. A flight rule was written to formally restrict 
RMS rates to a maximum of 63% of the value specified 
in HST’s Interface Control Document with the Orbiter. 
The PDRS (Payload Data Retrieval System) Operations 
Checklist documented the RMS settings used to 
configure for the reduced rate. 

3.2. Accepted Risks-Electrical 

In order to manipulate connectors, inhibits are required 
to assure that no electricity can flow while the crew is 
nearby. Should a powered connector result in a bent pin 
or contain orbital debris, there is risk of molten metal or, 
depending on the available voltage, shock. The type 
and placement of at least 2 inhibits is defined by JSC 
requirements. However, as for previous servicing 
missions, several connectors could not meet these 
requirements. (Reference NSTS 1700.7B para. 200.1: 
JSC MA2-99-170 Crew Mating/Demating of Powered 
Connectors). Two hazard reports were needed to 
document the connectors. One report (HR-EVA4A) 
documented inhibits and controls for connectors that 
met the requirements. An ARHR was written to 
document those connectors that could not meet the 
requirements and required operational controls to 
mitigate risk. For both reports, schematics and detailed 
assessments for nominal and off-nominal connectors 
were analyzed and hazards mitigated. 

The highest risk connectors are those that remain 
powered during their manipulation. For SM4, this 
occurred during the installation of the two battery 
modules. Seven powered connector mate/demate 


operations were addressed, five of which were Off- 
Nominal Tasks. Identified with each operation is 
requirement non-compliance and reason, along with 
acceptance rationale. 

3.3. Accepted Risks-Known Contact Hazards 

Four types of contact hazards were addressed: 
Temperature (high or low), Sharp Edge, Pinch Point and 
Protrusion. For the temperature related contact hazards, 
hot or cold temperatures could exceed glove rating and 
injure crew. Sharp edges can puncture the EMU and/or 
gloves, causing crew injury and/or reducing available 
EVA time. Pinch points and protrusions can interfere 
with the crew’s ability to access either HST or needed 
equipment on the carriers. 

3.3.1 Thermal Exceedances 

Crew Aids & Tools (CATs) and Handrails can expose 
personnel to hot/high touch temperatures. Non- 
compliant CATs were specifically documented as an 
appendix in the Contact Restrictions Document. The 
risk to the crew is injury due to excessive exposure to 
hot or cold temperatures. Handrails are exposed to 
space and uninsulated. Long duration contact 
frequently occurs during servicing, especially when 
supporting installation of a replacement unit or 
instrument. 

Flight Rules were used to define acceptable duration in 
Sun solar inertial attitude (worst case COLD or HOT) 
during EVA (e.g., handrails). Where the risk was 
higher, a warning was included on the EVA checklist as 
was done for the Wide-Field Camera installation. 
Additionally, the crew is trained to minimize exposure 
of CATs to the environment and use glove warmers 
when necessary or called out as a part of the EVA 
checklist. Due to sensitive optics, HST required 
various “sun protect” attitudes, resulting in exposure to 
very cold attitudes. Operations with instrument 
changeouts (COS, WFC, FGS) were carefully outlined 
in the timeline and the crew thoroughly understood the 
implications of the temperature extremes to their own 
safety as well in the vacuum of space. As for other 
operational controls, exposure times were a part of the 
scripted timeline. 

3.3.2 Known Sharp Edges, Pinch Points and 
Protrusions 

In some cases, tools required a functional sharp edge to 
perform their specified task. The sharp edge could result 
from small fastener size or a need to cut or puncture to 
perform the task. On SM4, several tasks were 
conducted in areas not designed for servicing. These 
areas, in particular, frequently required very small tools 



or cutting devices to access equipment internal to HST. 
Additionally, pinch points were unavoidable due to the 
need for hinges or pivot points. Protrusions are 
sometimes unavoidable due to design. 

Each tool and every piece of equipment in the payload 
bay was inspected for sharp edges and pinch points by 
members of the HST Safety Team as well as KSC’s 
Safety team. If the sharp edge could not be eliminated 
or was required for the item to perform its function, the 
Safety/EVA engineer documents its location for crew 
awareness and training to mitigate the occurrence of 
crew contact. The sharp edge or pinch point became 
listed within the Contact Restrictions Document (CRD) 
which contains identified contact hazards since the 
launch of HST. Once a part of the CRD, warnings and 
cautions were incorporated into other documents to 
assure that the crew remembered the operational control 
in real-time. Project safety engineers verified the 
operational controls had been implemented through 
reviewing Flight Data Files (FDF) procedures, and EVA 
Requirement Documents for CAUTION and 
WARNING notes, safe operation, and to identify 
requirements for crew related safety verification 
methods. The EVA Safety process implements these 
controls into the training requirements. 

4. EVA PROCESSES 

Developing scripts and timelines for EVA day 
operations required a coordinated effort including 
detailed engineering, prototypes, crew trials, re-design, 
and training. Training activities, coordinated and 
choreographed by the EVA team, include Neutral 
Buoyancy Laboratory (NBL) runs, crew briefings, one- 
gravity trainer sessions, and virtual reality sessions. 

These tasks resulted in well-designed and understood 
EVA tools and clear techniques for conducting the 
EVA. The safety engineering team supports the design 
process at their home -base Goddard Space Flight Center 
(GSFC) and also the astronauts’ office at Johnson Space 
Center (JSC) and during tool and EVA procedure 
development; while the EVA team assigned a dedicated 
safety representative to present EVA-specific topics to 
the JSC PSRP and participate in Hazard Report (HR) 
reviews. The entire team worked hand-in-hand with the 
CATs designers and developers through each stage from 
preliminary design to manufacture and delivery. 

Several peer-reviewed documents were established by 
the EVA team to document operational safety controls. 
The EVA Requirements Document (SMR-4028), 
provided baseline procedures and included cautions, 
warnings, notes, and constraints necessary for the safety 
of the crew, success of the mission, preservation of 
HST, and the complex interfaces in between the various 
elements. The EVA Requirements were then 


incorporated into the EVA Checklist, which is the step- 
by-step procedures used on-orbit by the crew during 
EVA. Off-nominal situations are addressed in the EVA 
Contingency Procedures (SMR-4064) and accounted for 
the severity level and likelihood of potential problems. 
Using this document, JSC developed a “Workarounds 
Cribsheet”, which provided instruction for anticipated 
problems which might have occurred during EVA. For 
example, this document provided the minimum number 
of turns of locks on in-bay stowage equipment required 
for safe landing and HST berthing. 

The EVA Verification Plan (HST-TR-0 10303, 
Appendix D) documented fit checks performed for each 
tool and interface for both HST and the carriers. Fig. 5 
shows a fit check being performed on the Science 
Instrument Command and Data Handling (SI C&DH) 
Unit. Verification was provided by reviewing signed-off 
work orders. The plan identified tool-to-tool fit, with 
instrument interfaces, translation paths, worksite access, 
mechanical advantage, and visual cues. 



Figure 5. Fit Check on SI C&DH with Power Grip Tool 
(PGT) and 6 ” wobble socket extension 


The EVA team conducted fit checks on equipment 
interfaces with the Go/No-Go Gauge, every possible 
socket option and extension, and tools in line with the 
Torque Matrix established by GSFC Mechanical 
Engineering. For example, all corners of the SI C&DH 
were evaluated for any interferences and assessed tight 
clearances. At the pad at the Kennedy Space Center 
(KSC) after hardware was installed on the stowage 
carriers, the EVA team verified that setup was in safe 
configuration for the mission within days of launch 
during the Payload Walk-down for quality control 
inspection of the equipment. 


As discussed in the previous section, the EVA Contact 
Restrictions Document (HST-OPS-0 10086) provided a 
single-point reference for keep out zones, no touch and 
no damage areas which crewmembers must not enter 
due to potential sharp edges, pinch points, protrusions, 
hot surfaces, high voltage, hardware damage by 
collision, loss of HST capability by electromagnetic 
fields, contamination by optical scattering via 
particulates or molecular absorption, reduction of 
radioactive capability. Examples of documented “No 
Touch” areas included all cable harnesses and ORU 
connector sockets, and selected connectors that have 
power applied to them during changeouts (such as the 
Battery modules) are listed. These zones were reviewed 
with the crew at every training session. 

During SM4, safety issues were considered, analyzed 
and addressed in detail during tool design and in detail 
during crew training. Even before STS- 125 crew was 
named, crew candidates conducted engineering 
evaluations to understand and address unique hardware 
design objectives for safety. One example - Alignment 
guides to prevent damage to carrier bolts were provided 
to reduce the possibility of incorrect stowage which 
could have resulted in loose equipment in the payload 
bay. Once selected, the EVA team presented lg 
overviews to the crew at JSC providing early hands-on 
experience with the hardware before going to NBL. 
Under water, spacewalks were carefully choreographed 
in a unique weightless-like environment, including 
reach and access, visibility, translation paths, and 
induced loads (see Fig. 6). After hours, days and years 
of practice, running the tasks in the NBL led to the 
estimation of time to complete these activities safely 
and the development of a timeline which balanced 
efficiency and safe execution. 


during the mission. Additionally, flight-like simulators 
were built for tabletop briefings at JSC along with 
virtual reality mockups to give the crew the best 
available sense of what it would be like to handle these 
new instruments and tools on orbit - including fit, form, 
and function. Fig. 7 shows the crew practicing SM4 
activities with mockup trainer. 



Figure 7. STIS Repair 1-G Trainer with Fastener 
Capture Plate and Mini-Power Tool 

During the mission (see Figs. 8 & 9), EVA and Safety 
personnel supported Mission Control on a 24 hour basis. 
Even when the crew was sleeping, the ground team was 
preparing for potential failures - including the 
possibility that the mission could be cut short and 
hardware that was not intended to go inside the space 
shuttle might have to be carried in during an emergency. 
Safety factors such as material composition and the 
limitation of airlock dimensions were considered and 
documented in contingency plans. 



Figure 6. Stowage of WFPC-3 on Aft Fixture at NBL 


Crew Familiarizations at both GSFC and KSC provided 
unique opportunities for the crew to interact with 
hardware designers and experts and practice on actual 
flight equipment that they would manipulate in space 



Figure 8. On-Orbit ACS Repair Photos - 
Top: Showing PGT engaging Grid Cutter blade 
Bottom: Removing ACS Circuit Card, with tool 
protecting crew from contact hazards 

5. CONCLUSION 

Early attention to safety considerations in mission 
design and strong verification and validation process for 
safety requirements helped assure a safe mission. 
Cooperation between HST’s Safety and EVA Teams in 
implementing and verifying operational controls greatly 
reduced risk for the crew. Including the crew in 
developing tools and techniques improved safety and 
proved invaluable for HST SM4. The close coordination 
of the mission team through producing and 
documenting the ARHR’s greatly enhanced the 
understanding of the hazards and controls associated 
with the mission. Methods used to appropriately 
mitigate the risk were reviewed not only by HST’s 
Safety and EVA teams members, but also by a panel of 
experienced engineers at JSC, which provided both 
insight and oversight for mitigation of hazards on HST 
SM4. Due to attention to engineering detail and careful 
planning and cooperation by HST’s EVA and Safety 
teams NASA’s Hubble Space Telescope has access to a 
better view of the universe and seven crew members 
returned safely home. 



Figure 9. On-Orbit photo: Refurbished Hubble Space 
Telescope poised for new discoveries 



Figure 10. “Weight on Wheels” Payload Flight Safety 
Phase Completed 




